While most of my technical research in industrial cybersecurity is proprietary to Dragos, some of my work has been published publicly. Here is a complete list of all my publicly available research.


Malware Analysis

• Dragos Blog: Contributor to Dragos' RE and analysis of ControlLogix Vulnerabilities
• Dragos Whitepaper: Contributor to Dragos' COSMICENERGY analysis and reverse engineering
• Dragos Blog: Deep Dive Into PIPEDREAM's OPC UA Module, MOUSEHOLE
• Dragos Webinar: PIPEDREAM Malware and the CHERNOVITE Threat Group
• Dragos Blog: The Trojan Horse Malware & Password "Cracking" Ecosystem Targeting Industrial Operators

Vulnerability Research and Analysis

• Full Listing of CVEs
• Dragos Webinar: 2021 Dragos Examining ICS Vulnerabilities
• Dragos Webinar: 2020 Dragos Examining ICS Vulnerabilities

Vulnerability Research Against DirectLogic 06 PLC and C-More HMI

• Security Week: AutomationDirect Patches Vulnerabilities in PLC, HMI Products

Trojan Horse Password Cracking Research:

• Dragos: The Trojan Horse Malware & Password “Cracking” Ecosystem Targeting Industrial Operators
• Ars Technica: Hackers are targeting industrial systems with malware
• Bleeping Computer: Password recovery tool infects industrial systems with Sality malware
• The Hacker News: Hackers Distributing Password Cracking Tool for PLCs and HMIs to Target Industrial Systems
• Security Week: PLC and HMI Password Cracking Tools Deliver Malware
• Industrial Cyber: Dragos details Trojan Horse malware, password cracking ecosystem affecting industrial operators
• Secure Blink: Salty malware used to infect ICS through password cracking tool
• HelpNet Security: Beware of password-cracking software for PLCs and HMIs!
• The Tech Outlook: Hackers targeting industrial PLCs with a new password cracking tool by remaining undetected

Comments, Quotes, and Random Tidbits

• Ars Technica: Comment on Microsoft-disovered CoDeSys Vulnerabilities